[curves] Isogeny patterns among Edwards curves

[Robert Ransom]

On 1/29/14, Mike Hamburg <mike at shiftleft.org> wrote:
>
> On Jan 29, 2014, at 6:52 AM, Robert Ransom <rransom.8774 at gmail.com> wrote:

>> The first pattern is that Ed(1, d) is isogenous to Ed(-1, d-1) for
>> every d that I have tested.
>
> I noticed this too, and I wrote up pretty much exactly what you're thinking.
>  See http://eprint.iacr.org/2014/027.pdf :-)

If d is a non-square, there's also an isomorphism to an a=-1 curve,
obtained by composing the twist maps Ed(1, d) -> Ed(1, 1/d) -> Ed(-1,
-1/d).  That has the advantages that the result always also has d/a
non-square (whereas Ed(-1, 3617-1) doesn't), and the map is simpler to
describe; and the disadvantage that one set of implementations has to
handle a non-small-integer d.

The isogeny is probably better overall, unless d is chosen to be random.


Robert Ransom